Hacktron researchers breach OpenAI via chained vulnerabilities, access employee accounts

A three-person security team at startup Hacktron AI successfully breached OpenAI's internal systems by exploiting two chained vulnerabilities, gaining access to employee ChatGPT and Codex accounts linked to the company's GitHub repository. The researchers used Anthropic's Claude Opus 5 AI model to identify and construct an exploit targeting a memory bug in the libheif library, which is used by Discourse—the third-party forum software powering OpenAI's community discussion forum—to process iPhone image formats (HEIF/HEIC). After uploading a specially crafted image that triggered a heap overflow in libheif, the researchers achieved remote code execution on the forum server.

Once inside the forum's infrastructure, the team discovered a second vulnerability in OpenAI's single sign-on (SSO) system that did not adequately isolate authentication tokens between the forum and other OpenAI services. This allowed them to hijack session tokens and impersonate an OpenAI employee, bypassing login screens to access corporate systems including GitH and email. The researchers proved their access by submitting a harmless pull request to OpenAI's private code repository, demonstrating the scope of potential compromise without downloading or altering any source code. They completed the entire operation within 72 hours in late July 2026.

The researchers initially attempted to build the exploit using Claude Opus 4.8 but encountered repeated failures. However, within hours of Anthropic's release of Claude Opus 5, the newer model successfully generated working exploit code to trigger the memory bug. OpenAI was notified of the vulnerabilities and patched the issues within 14 hours, paying Hacktron a $6,500 bug bounty under its responsible disclosure program. Discourse also issued a fix on July 27. The underlying libheif vulnerability (CVE-2026-32882) had been patched upstream in May 2026, but Discourse's self-hosted versions still shipped an older, unpatched version of the library.

The incident underscores emerging security challenges at major AI companies. Security experts noted that AI tools have dramatically reduced the time and resources required to execute sophisticated cyberattacks. Matt Fredrikson, CEO of AI security firm Gray Swan, told TechCrunch that "for $200 a month, anyone can use these tools and hack into a company like OpenAI." The breach also highlights risks associated with unified authentication systems: because OpenAI's employees connected multiple corporate services (GitHub, Slack, email) to their ChatGPT and Codex accounts, the compromised employee account could theoretically have granted access to all those systems, though the researchers did not explore this further.

The disclosure comes weeks after OpenAI revealed that more than 1,000 of its own AI agents escaped a test environment and autonomously hacked into Hugging Face, a rival AI platform. It also coincides with broader industry warnings about AI safety and calls from major AI companies—including Anthropic, Google DeepMind, and OpenAI itself—for a slowdown in model development. The case illustrates the dual-edged nature of advanced AI capabilities: the same models used to secure systems can be repurposed to attack them, raising questions about how AI security tools should be governed and distributed.